This module on Software Development & Application Security focuses on integrating security into the software development lifecycle (SDLC) to create resilient applications from the ground up. In a world where software vulnerabilities lead to massive breaches (e.g., the 2024 CrowdStrike outage affecting millions), "secure by design" principles are essential. Students will work with code, pipelines, and tools to embed security practices, reducing risks like injection attacks or misconfigurations. By the end of this module, students will be able to:
As of August 28, 2025, the OWASP Top 10 is on track for a 2025 update (expected late summer/early fall), building on the 2021 version with potential emphasis on AI/ML risks and supply chain security. Trends include AI-assisted scanning in CI/CD (used in 25% of pipelines) and zero-trust for APIs. OWASP ZAP's latest version is 2.16.1, with enhancements for automation and Edge browser support. GitLab CI/CD (version 18.x in 2025) embeds SAST/DAST natively, with new features like protected repositories and AI-driven vuln prioritization.
Estimated Time: 5-7 hours of lecture/discussion, plus coding labs (e.g., securing a sample app).
Prerequisites: Introduction to Programming, Cybersecurity Fundamentals.
Assessment Ideas:
Secure SDLC (SSDLC) embeds security at every phase: Planning, Design, Implementation, Testing, Deployment, Maintenance. In 2025, best practices emphasize "shift left" (early security integration), security-first culture, and automation to address rising supply chain attacks.
The OWASP Top 10 lists the most critical web app security risks. The 2021 version (current as of August 2025, with 2025 update imminent) includes A01: Broken Access Control, A02: Cryptographic Failures, A03: Injection, etc. Predictions for 2025 highlight increased focus on known vulns and misconfigurations based on CVE data.
SAST analyzes source code statically for vulns; DAST tests running apps dynamically. In 2025, trends include AI-enhanced tools for fewer false positives and seamless CI/CD integration (e.g., in GitLab, GitHub Actions).
stages: [test] with SAST tools like SonarQube); fail builds on high-severity issues.APIs are prime targets; OWASP API Security Top 10 (2023 version, no 2025 update yet) covers risks like Broken Object Level Authorization (BOLA).
Include these in lectures for visual aids; students can practice in Mermaid editors.
Flowchart of SSDLC stages with security integrations.
flowchart TD
A[Planning: Requirements & Threat Modeling] --> B[Design: Secure Architecture & Reviews]
B --> C[Implementation: Secure Coding & SAST]
C --> D[Testing: DAST & Penetration Testing]
D --> E[Deployment: CI/CD with Scans]
E --> F[Maintenance: Monitoring & Patching]
F --> A[Iterate]
style A fill:#f9f,stroke:#333
style F fill:#bbf,stroke:#333
Explanation in Class: Each phase includes security (e.g., SAST in code); discuss "shift left" by moving scans to earlier stages.
Graph showing a sample pipeline.
graph LR
A[Commit Code] --> B[Build Stage]
B --> C[Test Stage: Unit Tests]
C --> D[Security Stage: SAST Scan SonarQube]
D --> E[Security Stage: DAST Scan OWASP ZAP]
E --> F[Deploy Stage: If Scans Pass]
F --> G[Monitor: Runtime Protection]
style D fill:#ff9,stroke:#333
style E fill:#ff9,stroke:#333
Explanation in Class: Highlight failure gates; integrate with GitLab's .yml for labs.
Mind map of categories (based on 2021, adaptable for 2025).
mindmap
root((OWASP Top 10))
A01["Broken Access Control"]
A02["Cryptographic Failures"]
A03["Injection"]
A04["Insecure Design"]
A05["Security Misconfiguration"]
A06["Vulnerable Components"]
A07["ID & Auth Failures"]
A08["Software/Data Integrity"]
A09["Logging/Monitoring Failures"]
A10["SSRF"]
Explanation in Class: Link each to fixes; update with 2025 predictions (e.g., more on AI vulns).
Stay updated via OWASP announcements for the 2025 Top 10 release and sources like Dark Reading for trends. End with Q&A on explained terms.